PT-2026-71513

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

Online Food Ordering System 1.0 Shell Upload

Online Food Ordering System version 1.0 suffers from a remote shell upload vulnerability. The upload endpoint /web/admin/updatefood.php accepts files with any extension, including .php, and stores them in the web-accessible directory without renaming or sanitizing the filename. Titles:...

CVE-2026-28176: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

PT-2026-71525

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-27380: Deserialization of Untrusted Data

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

PT-2026-71882

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.47 FreePBX versions prior to 17.0.30 Description The FreePBX Framework module allows an authenticated user with write access to backup files or sufficient backup-restore permissions to disable authentication. By...

PT-2026-80143

TuxCare rebuilt phenx/php-svg-lib to address 3 CVEs. Fixed in 0.4.1-p1+tuxcare...

CVE-2026-73532: Embedded Malicious Code

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

PT-2026-71497

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

PT-2026-71579

Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...

PT-2026-71486

Name of the Vulnerable Software and Affected Versions WebErpMesv2 versions prior to 1.20 Description WebErpMesv2 allows self-registered users to upload arbitrary PHP files via the scan file parameter in the HR Expense section, resulting in Remote Code Execution RCE. This is exacerbated by open...

PT-2026-71391

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-28149: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

PT-2026-80149

TuxCare rebuilt webonyx/graphql-php to address 4 CVEs. Fixed in v14.11.10-p1+tuxcare...

CVE-2026-46382: Server-Side Request Forgery (SSRF)

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-46688: URL Redirection to Untrusted Site

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that wil...

CVE-2026-46382

MRBS prior to v1.12.2 is vulnerable to server-side request forgery during import, where a user-supplied private/local URI can be fetched without validation. The fixed version is v1.12.2; no workaround is listed in the provided documents. Remediation: upgrade to v1.12.2 or newer as stated in the s...

EUVD-2026-57701

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...